rpms/selinux-policy-strict/FC-4 policy-20050916.patch, 1.16, 1.17 selinux-policy-strict.spec, 1.334, 1.335
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Tue Jan 3 03:42:02 UTC 2006
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/FC-4
In directory cvs.devel.redhat.com:/tmp/cvs-serv32261
Modified Files:
policy-20050916.patch selinux-policy-strict.spec
Log Message:
* Mon Jan 2 2006 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.18
- Allow pam_module to work with apache
policy-20050916.patch:
Makefile | 26 +-
attrib.te | 100 +++++++++-
domains/admin.te | 2
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 9
domains/program/getty.te | 2
domains/program/hostname.te | 2
domains/program/ifconfig.te | 10 -
domains/program/init.te | 2
domains/program/initrc.te | 26 ++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 11 -
domains/program/login.te | 23 +-
domains/program/logrotate.te | 2
domains/program/modutil.te | 27 +-
domains/program/mount.te | 6
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/passwd.te | 2
domains/program/restorecon.te | 6
domains/program/setfiles.te | 4
domains/program/ssh.te | 6
domains/program/su.te | 12 +
domains/program/syslogd.te | 7
domains/program/tmpreaper.te | 2
domains/program/unused/NetworkManager.te | 13 +
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 +------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 25 +-
domains/program/unused/apmd.te | 25 ++
domains/program/unused/auditd.te | 9
domains/program/unused/automount.te | 4
domains/program/unused/avahi.te | 31 +++
domains/program/unused/bluetooth.te | 72 +++++++
domains/program/unused/cups.te | 24 +-
domains/program/unused/cvs.te | 2
domains/program/unused/cyrus.te | 10 -
domains/program/unused/dbusd.te | 4
domains/program/unused/dcc.te | 5
domains/program/unused/dhcpc.te | 6
domains/program/unused/dhcpd.te | 4
domains/program/unused/dovecot.te | 6
domains/program/unused/exim.te | 309 +++++++++++++++++++++++++++++++
domains/program/unused/ftpd.te | 6
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 10 -
domains/program/unused/hwclock.te | 1
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 7
domains/program/unused/mysqld.te | 10 -
domains/program/unused/named.te | 27 ++
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 +
domains/program/unused/pamconsole.te | 4
domains/program/unused/pegasus.te | 36 +++
domains/program/unused/ping.te | 2
domains/program/unused/postfix.te | 63 ++++--
domains/program/unused/postgresql.te | 11 -
domains/program/unused/pppd.te | 23 +-
domains/program/unused/privoxy.te | 2
domains/program/unused/procmail.te | 16 +
domains/program/unused/radius.te | 3
domains/program/unused/readahead.te | 21 ++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 ++
domains/program/unused/rpcd.te | 18 +
domains/program/unused/rpm.te | 4
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 15 +
domains/program/unused/saslauthd.te | 1
domains/program/unused/sendmail.te | 3
domains/program/unused/slapd.te | 28 ++
domains/program/unused/snmpd.te | 6
domains/program/unused/spamd.te | 28 --
domains/program/unused/squid.te | 4
domains/program/unused/udev.te | 10 -
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 ++++
domains/program/unused/ypserv.te | 9
domains/program/unused/zebra.te | 2
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/apache.fc | 3
file_contexts/program/bluetooth.fc | 3
file_contexts/program/compat.fc | 4
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 5
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 -
file_contexts/program/innd.fc | 15 -
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 9
file_contexts/program/pppd.fc | 2
file_contexts/program/privoxy.fc | 1
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/slapd.fc | 12 +
file_contexts/program/squid.fc | 3
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 6
genfs_contexts | 3
macros/base_user_macros.te | 7
macros/core_macros.te | 9
macros/global_macros.te | 33 ++-
macros/home_macros.te | 9
macros/network_macros.te | 17 +
macros/program/apache_macros.te | 13 +
macros/program/bonobo_macros.te | 2
macros/program/cdrecord_macros.te | 6
macros/program/chkpwd_macros.te | 8
macros/program/crontab_macros.te | 2
macros/program/dbusd_macros.te | 7
macros/program/gconf_macros.te | 2
macros/program/gift_macros.te | 2
macros/program/gpg_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++
macros/program/lpr_macros.te | 2
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/program/xdm_macros.te | 2
macros/program/ypbind_macros.te | 1
macros/user_macros.te | 7
man/man8/ftpd_selinux.8 | 19 +
man/man8/httpd_selinux.8 | 9
man/man8/rsync_selinux.8 | 12 -
man/man8/samba_selinux.8 | 9
mcs | 210 ++++++++-------------
mls | 270 ++++++++++-----------------
net_contexts | 13 +
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/compat.te | 1
targeted/domains/program/sendmail.te | 1
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 15 +
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/device.te | 4
types/devpts.te | 4
types/file.te | 48 +---
types/network.te | 13 -
types/nfs.te | 1
types/security.te | 6
161 files changed, 1668 insertions(+), 688 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/FC-4/policy-20050916.patch,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- policy-20050916.patch 30 Nov 2005 22:07:48 -0000 1.16
+++ policy-20050916.patch 3 Jan 2006 03:41:57 -0000 1.17
@@ -945,7 +945,16 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apache.te policy-1.27.1/domains/program/unused/apache.te
--- nsapolicy/domains/program/unused/apache.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/apache.te 2005-11-30 16:42:28.000000000 -0500
++++ policy-1.27.1/domains/program/unused/apache.te 2006-01-02 14:02:37.000000000 -0500
+@@ -66,7 +66,7 @@
+
+ # httpd_exec_t is the type give to the httpd executable.
+ #
+-daemon_domain(httpd, `, privmail, nscd_client_domain')
++daemon_domain(httpd, `, privmail, auth_chkpwd, nscd_client_domain')
+
+ append_logdir_domain(httpd)
+ #can read /etc/httpd/logs
@@ -113,9 +113,12 @@
can_network_server(httpd_t)
can_kerberos(httpd_t)
@@ -2774,9 +2783,12 @@
tmp_domain(sendmail)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/slapd.te policy-1.27.1/domains/program/unused/slapd.te
--- nsapolicy/domains/program/unused/slapd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/slapd.te 2005-11-30 16:42:28.000000000 -0500
-@@ -24,8 +24,9 @@
++++ policy-1.27.1/domains/program/unused/slapd.te 2005-12-20 15:45:56.000000000 -0500
+@@ -22,10 +22,12 @@
+
+ # Use the network.
can_network(slapd_t)
++can_kerberos(slapd_t)
allow slapd_t port_type:tcp_socket name_connect;
can_ypbind(slapd_t)
-allow slapd_t self:fifo_file { read write };
@@ -2787,7 +2799,16 @@
allow slapd_t self:unix_dgram_socket create_socket_perms;
# allow any domain to connect to the LDAP server
can_tcp_connect(domain, slapd_t)
-@@ -55,7 +56,23 @@
+@@ -45,7 +47,7 @@
+ create_dir_file(slapd_t, slapd_replog_t)
+
+ # read config files
+-allow slapd_t etc_t:{ file lnk_file } { getattr read };
++allow slapd_t etc_t:{ file lnk_file } r_file_perms;
+ allow slapd_t etc_runtime_t:file { getattr read };
+
+ # for startup script
+@@ -55,7 +57,23 @@
read_sysctl(slapd_t)
@@ -4111,7 +4132,7 @@
-ifeq ($(MCS),y)
-TYPE=mcs
-endif
-+TYPE=strict
++TYPE=targeted
INSTALLDIR = $(TOPDIR)/$(TYPE)
POLICYPATH = $(INSTALLDIR)/policy
@@ -5079,7 +5100,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.27.1/types/file.te
--- nsapolicy/types/file.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/file.te 2005-11-30 16:42:28.000000000 -0500
++++ policy-1.27.1/types/file.te 2005-12-02 18:26:35.000000000 -0500
@@ -84,6 +84,9 @@
#
type etc_t, file_type, sysadmfile;
@@ -5098,16 +5119,18 @@
# for /var/{spool,lib}/texmf index files
type tetex_data_t, file_type, sysadmfile, tmpfile;
type var_spool_t, file_type, sysadmfile, tmpfile;
-@@ -273,9 +277,6 @@
+@@ -271,10 +275,7 @@
+ # Allow each file type to be associated with
+ # the default file system type.
#
- allow { file_type device_type ttyfile } fs_t:filesystem associate;
-
+-allow { file_type device_type ttyfile } fs_t:filesystem associate;
+-
-# Allow the pty to be associated with the file system.
-allow devpts_t self:filesystem associate;
--
++allow { file_type device_type ttyfile fs_type } fs_t:filesystem associate;
+
type tmpfs_t, file_type, mount_point, sysadmfile, fs_type;
allow { logfile tmpfs_t tmpfile home_type } tmpfs_t:filesystem associate;
- allow { logfile tmpfile home_type } tmp_t:filesystem associate;
@@ -284,31 +285,14 @@
')
Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/FC-4/selinux-policy-strict.spec,v
retrieving revision 1.334
retrieving revision 1.335
diff -u -r1.334 -r1.335
--- selinux-policy-strict.spec 1 Dec 2005 18:25:13 -0000 1.334
+++ selinux-policy-strict.spec 3 Jan 2006 03:41:57 -0000 1.335
@@ -11,7 +11,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 2.16
+Release: 2.18
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -229,6 +229,12 @@
exit 0
%changelog
+* Mon Jan 2 2006 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.18
+- Allow pam_module to work with apache
+
+* Thu Dec 1 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.17
+- Allow slapd to user kerberos
+
* Thu Dec 1 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.16
- Load the correct policy
More information about the fedora-cvs-commits
mailing list